miniduke | a1c2557181e7a1b47dc267ab9c3f6edea527a2aaa7644ce1b666fda16eb92425

General

Target
2026-04-24_29ea4bc132f185b02ffcdb24752b9feb_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 2.2MB
Sample260424-lrwqdset3t
SHA256 a1c2557181e7a1b47dc267ab9c3f6edea527a2aaa7644ce1b666fda16eb92425
MD5 29ea4bc132f185b02ffcdb24752b9feb
SHA1 53c5f3e4cfdb926113fc9269554e268353dae0b4
SHA512 c24d57348d897988d8ea7ed23c20cd9e6fd64c16f3d480f53fca057366c3da3cbc1f52a9ca90837efa92e7b23a02fe0db47c61474d5c9504f6da4857c903157a
SSDEEP 24576:Re6u/O8D3RS50YKkytHy3jiUQ+xcV5K8ZM5mhnL1ofRm5ydK8eokoL6:ROm8zY0gG7QyK8ZQmnLoGPode
TLSH
T129B52220B7C18073C12715B84AE5FBB85769BD622BF298DF17C556F80F642C2937A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-24_29ea4bc132f185b02ffcdb24752b9feb_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 2.2MB
- SHA256 a1c2557181e7a1b47dc267ab9c3f6edea527a2aaa7644ce1b666fda16eb92425
- MD5 29ea4bc132f185b02ffcdb24752b9feb
- SHA1 53c5f3e4cfdb926113fc9269554e268353dae0b4
- SHA512 c24d57348d897988d8ea7ed23c20cd9e6fd64c16f3d480f53fca057366c3da3cbc1f52a9ca90837efa92e7b23a02fe0db47c61474d5c9504f6da4857c903157a
- SSDEEP 24576:Re6u/O8D3RS50YKkytHy3jiUQ+xcV5K8ZM5mhnL1ofRm5ydK8eokoL6:ROm8zY0gG7QyK8ZQmnLoGPode
- TLSH
  T129B52220B7C18073C12715B84AE5FBB85769BD622BF298DF17C556F80F642C2937A31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer upx
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2